{"record":{"id":"5b2f5afcc083323a","repo":"TechnitiumSoftware/DnsServer","slug":"the-ecdsa-keytype-dnssecprivatekeytype-keysi-5b2f5a","errorCode":null,"errorMessage":"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 384 bits.","messagePattern":"The ECDSA \\((.+?)\\) private key must have key size of 384 bits\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":255,"sourceCode":"\n                case DnssecAlgorithm.ECDSAP256SHA256:\n                    using (ECDsa ecdsa = ECDsa.Create())\n                    {\n                        ecdsa.ImportFromPem(pemPrivateKey);\n\n                        if (ecdsa.KeySize != 256)\n                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 256 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP384SHA384:\n                    using (ECDsa ecdsa = ECDsa.Create())\n                    {\n                        ecdsa.ImportFromPem(pemPrivateKey);\n\n                        if (ecdsa.KeySize != 384)\n                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 384 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ED25519:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed25519PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed25519 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                case DnssecAlgorithm.ED448:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed448 curve.\", nameof(pemPrivateKey));","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L237-L273","documentation":"Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ECDSAP384SHA384 when the imported ECDsa key's KeySize is not exactly 384 bits. As with the P-256 case, the curve fixes the size and any mismatch indicates a PEM for a different curve.","triggerScenarios":"Calling Create(ECDSAP384SHA384, keyType, pem) where the PEM decodes to a non-P-384 EC key (e.g. P-256).","commonSituations":"Using a P-256 PEM with the P-384 algorithm; mislabeling key files during rotation.","solutions":["Regenerate a P-384 key: openssl ecparam -name secp384r1 -genkey -noout -out key.pem.","If the PEM is genuinely P-256, use DnssecAlgorithm.ECDSAP256SHA256 instead.","Align the DnssecAlgorithm with the PEM's curve."],"exampleFix":"// before: pem is a P-256 key\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP384SHA384, kt, p256Pem); // throws\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, kt, p256Pem);","handlingStrategy":"validation","validationCode":"using var ecdsa = ECDsa.Create();\necdsa.ImportFromPem(pem);\nif (ecdsa.KeySize != 384)\n    throw new InvalidOperationException($\"ECDSA key is {ecdsa.KeySize} bits; ECDSAP384SHA384 requires 384 (P-384).\");\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP384SHA384, keyType, pem);","typeGuard":"static bool PemIsP384(string pem)\n{\n    try { using var e = ECDsa.Create(); e.ImportFromPem(pem); return e.KeySize == 384; }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP384SHA384, keyType, pem); }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(pem))\n{ throw new InvalidOperationException(\"PEM is not a P-384 key; check the curve or use ECDSAP256SHA256.\", ex); }","preventionTips":["Generate keys on secp384r1 for the P-384 algorithm.","Keep the DnssecAlgorithm and the PEM curve in lockstep.","Name key files by curve to prevent cross-use."],"tags":["dns","dnssec","crypto","ecdsa","pem","key-size"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}